AmpulPrivacy Policy
This policy explains what the Ampul iPhone app and the ampul.app website collect, why, who else handles it, and how to get it deleted. "Ampul", "we" and "us" mean [OWNER: legal name of the person or company that operates Ampul, and its mailing address].
The short version
- We store your account and the protocols, doses and vials you log so the app can sync them.
- When you ask the AI a question, the question and a summary of your current stack are sent to OpenAI through our server to get an answer.
- No ads. We don't sell or rent your data. The app contains no third-party analytics, advertising or tracking SDKs.
- Email support@ampul.app and we'll delete your account and data.
What we collect
Account. Your email address and a password. Passwords are handled by our authentication provider (Supabase) and stored hashed; we never see them in plain text.
What you log. Information you enter about your peptide use, which can be health-related:
- Protocols: peptide name, dose, frequency, times per day, scheduled times, start and end dates, vial size, bacteriostatic water amount, and any notes.
- Doses: peptide, amount, injection site, date and time, and notes.
- Vials: peptide, total milligrams, water added, reconstitution date, amount used, and notes.
Feedback. If you send feedback in the app, we store its type, title and description along with your account ID so we can follow up.
On your device only. App preferences (such as appearance, reminder timing and answers from onboarding like when you usually train), a local copy of your data for offline use, and saved research results. These stay on your phone.
Server logs. Our hosting providers keep standard request logs, which include IP addresses and timestamps, for security and debugging.
We do not collect your location, contacts, photos, Apple Health data or advertising identifier.
How we use it
- To run the app: sync your data across sign-ins, show your Today timeline, history and levels.
- To answer AI questions with your stack in mind (see below).
- To read and respond to feedback and support requests.
- To keep the service secure and to limit abuse, for example capping daily AI usage.
We don't use your data for advertising or build marketing profiles.
AI questions
When you use Ask AI or the AI chat, the app sends your question to our server, which forwards it to OpenAI to generate the answer. To make the answer relevant, the request also includes a summary of your active protocols: peptide names, doses, schedules, start dates, when you last dosed, how many doses you logged in the last 7 days, your protocol notes, and your training time if you set one. It can also include PubMed study abstracts. Your email address and name are not included.
OpenAI processes this data to produce the response, under its API data terms. [OWNER: confirm the OpenAI API data-retention terms that apply to your account (by default, API data is not used for training and may be kept up to 30 days for abuse monitoring) and whether you have zero-data-retention.] We don't store your AI questions or answers on our servers. [OWNER: confirm; the ai-proxy function does not log prompts, but check Supabase function logging.]
Reminders
Dose reminders are local notifications scheduled by iOS on your device from your protocols. We don't use push notification servers, and reminder content isn't sent to us. You can turn notifications off in iOS Settings at any time.
Research, news and Market
- PubMed. When you search research, the app requests results directly from the U.S. National Library of Medicine (NCBI) PubMed service. NCBI receives the search terms (such as a peptide name) and your IP address, but nothing from your Ampul account.
- News. News items link to the original publisher, journal or video site. Opening a link takes you to that site, which has its own privacy policy.
- Market. Prices are collected by our server from vendors' public product listings. When you tap an offer, the vendor's site opens in your browser and that vendor's privacy policy applies. Some links include an affiliate or referral code, which lets the vendor know the visit came from Ampul. We don't share your account or logged data with vendors.
Who processes your data
- Supabase: database, authentication and server functions that store your account and logs. [OWNER: confirm Supabase project region, e.g. US East.]
- OpenAI: generates AI answers from the requests described above.
- Cloudflare: hosts this website.
- Apple: distributes the app and delivers local notifications on your device.
We share data with these providers only so they can run the service for us. We may also disclose information if the law requires it, or to protect the rights and safety of users or others. If Ampul is sold or merged, your data may transfer to the new owner under this policy.
No ads, no selling, no tracking
Ampul shows no ads and does not sell, rent or trade your personal information. The app contains no third-party analytics, advertising, attribution or crash-reporting SDKs, and it does not track you across other companies' apps or websites. The website sets no cookies and runs no analytics; it loads fonts from Google Fonts, which means Google receives your IP address when you load a page.
How long we keep it
We keep your account and logged data until you delete it or ask us to delete your account. Deleted items are removed from our database; backups held by our providers roll off on their normal schedule. [OWNER: state backup retention, e.g. "within 30 days".] Server logs are kept for a short period by our providers.
Your choices and rights
- Edit or delete entries any time in the app.
- Export your protocols and dose history as a JSON file from Settings → Export Data.
- Sign out from Settings. This clears the local copy of your data and cancels reminders on that device.
- Delete your account by emailing support@ampul.app from the address on your account. We'll delete your account and all data tied to it within 30 days and confirm by email. [OWNER: the app has no in-app "Delete Account" button yet; Apple App Store guideline 5.1.1(v) requires one for apps that let you create an account. Add it, then update this line.]
Depending on where you live (for example the EU, UK or California), you may have the right to access, correct, delete or port your data, or to object to certain processing. Email us and we'll respond within 30 days. We don't sell or "share" personal information for cross-context behavioral advertising as those terms are defined in California law. Where the GDPR applies, we rely on performing our contract with you to run the app and on your explicit consent for the health-related information you choose to log and send to the AI. You can withdraw consent by deleting that data or your account. [OWNER: if you serve EU/UK users, decide whether you need an EU/UK representative.]
Security
Data is encrypted in transit (HTTPS), and each account can only read its own records. [OWNER: confirm row-level security is enabled on the protocols, injections, vials and feedback tables; those policies are not in this repo's migrations.] No system is perfectly secure, so please use a strong, unique password.
Health information
Ampul is not a healthcare provider, and the information you log is not covered by HIPAA. We still treat it as sensitive: it's used only to run the features described here.
Children
Ampul is not for anyone under 18. We don't knowingly collect data from minors. If you believe a minor has created an account, email us and we'll delete it.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll let you know in the app before it takes effect.
Contact
Questions or requests: support@ampul.app.